2 * Copyright (c) 1997 - 2007 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the Institute nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34 #include "krb5_locl.h"
36 #ifndef HEIMDAL_SMALLER
38 /* afs keyfile operations --------------------------------------- */
41 * Minimum tools to handle the AFS KeyFile.
43 * Format of the KeyFile is:
44 * <int32_t numkeys> {[<int32_t kvno> <char[8] deskey>] * numkeys}
46 * It just adds to the end of the keyfile, deleting isn't implemented.
47 * Use your favorite text/hex editor to delete keys.
51 #define AFS_SERVERTHISCELL "/usr/afs/etc/ThisCell"
52 #define AFS_SERVERMAGICKRBCONF "/usr/afs/etc/krb.conf"
62 * set `d->cell' and `d->realm'
66 get_cell_and_realm (krb5_context context
, struct akf_data
*d
)
69 char buf
[BUFSIZ
], *cp
;
72 f
= fopen (AFS_SERVERTHISCELL
, "r");
75 krb5_set_error_message (context
, ret
,
76 N_("Open ThisCell %s: %s", ""),
81 if (fgets (buf
, sizeof(buf
), f
) == NULL
) {
83 krb5_set_error_message (context
, EINVAL
,
84 N_("No cell in ThisCell file %s", ""),
88 buf
[strcspn(buf
, "\n")] = '\0';
91 d
->cell
= strdup (buf
);
92 if (d
->cell
== NULL
) {
93 krb5_set_error_message(context
, ENOMEM
,
94 N_("malloc: out of memory", ""));
98 f
= fopen (AFS_SERVERMAGICKRBCONF
, "r");
100 if (fgets (buf
, sizeof(buf
), f
) == NULL
) {
104 krb5_set_error_message (context
, EINVAL
,
105 N_("No realm in ThisCell file %s", ""),
106 AFS_SERVERMAGICKRBCONF
);
109 buf
[strcspn(buf
, "\n")] = '\0';
113 for (cp
= buf
; *cp
!= '\0'; cp
++)
114 *cp
= toupper((unsigned char)*cp
);
116 d
->realm
= strdup (buf
);
117 if (d
->realm
== NULL
) {
120 krb5_set_error_message(context
, ENOMEM
,
121 N_("malloc: out of memory", ""));
128 * init and get filename
131 static krb5_error_code
132 akf_resolve(krb5_context context
, const char *name
, krb5_keytab id
)
135 struct akf_data
*d
= malloc(sizeof (struct akf_data
));
138 krb5_set_error_message(context
, ENOMEM
,
139 N_("malloc: out of memory", ""));
144 ret
= get_cell_and_realm (context
, d
);
149 d
->filename
= strdup (name
);
150 if (d
->filename
== NULL
) {
154 krb5_set_error_message(context
, ENOMEM
,
155 N_("malloc: out of memory", ""));
167 static krb5_error_code
168 akf_close(krb5_context context
, krb5_keytab id
)
170 struct akf_data
*d
= id
->data
;
182 static krb5_error_code
183 akf_get_name(krb5_context context
,
188 struct akf_data
*d
= id
->data
;
190 strlcpy (name
, d
->filename
, name_sz
);
198 static krb5_error_code
199 akf_start_seq_get(krb5_context context
,
204 struct akf_data
*d
= id
->data
;
206 c
->fd
= open (d
->filename
, O_RDONLY
| O_BINARY
| O_CLOEXEC
, 0600);
209 krb5_set_error_message(context
, ret
,
210 N_("keytab afs keyfile open %s failed: %s", ""),
211 d
->filename
, strerror(ret
));
215 c
->sp
= krb5_storage_from_fd(c
->fd
);
216 ret
= krb5_ret_uint32(c
->sp
, &d
->num_entries
);
218 krb5_storage_free(c
->sp
);
220 krb5_clear_error_message (context
);
221 if(ret
== KRB5_KT_END
)
222 return KRB5_KT_NOTFOUND
;
229 static krb5_error_code
230 akf_next_entry(krb5_context context
,
232 krb5_keytab_entry
*entry
,
233 krb5_kt_cursor
*cursor
)
235 struct akf_data
*d
= id
->data
;
240 pos
= krb5_storage_seek(cursor
->sp
, 0, SEEK_CUR
);
242 if ((pos
- 4) / (4 + 8) >= d
->num_entries
)
245 ret
= krb5_make_principal (context
, &entry
->principal
,
246 d
->realm
, "afs", d
->cell
, NULL
);
250 ret
= krb5_ret_int32(cursor
->sp
, &kvno
);
252 krb5_free_principal (context
, entry
->principal
);
258 entry
->keyblock
.keytype
= ETYPE_DES_CBC_MD5
;
259 entry
->keyblock
.keyvalue
.length
= 8;
260 entry
->keyblock
.keyvalue
.data
= malloc (8);
261 if (entry
->keyblock
.keyvalue
.data
== NULL
) {
262 krb5_free_principal (context
, entry
->principal
);
263 krb5_set_error_message(context
, ENOMEM
,
264 N_("malloc: out of memory", ""));
269 ret
= krb5_storage_read(cursor
->sp
, entry
->keyblock
.keyvalue
.data
, 8);
271 ret
= (ret
< 0) ? errno
: KRB5_KT_END
;
275 entry
->timestamp
= time(NULL
);
277 entry
->aliases
= NULL
;
280 krb5_storage_seek(cursor
->sp
, pos
+ 4 + 8, SEEK_SET
);
284 static krb5_error_code
285 akf_end_seq_get(krb5_context context
,
287 krb5_kt_cursor
*cursor
)
289 krb5_storage_free(cursor
->sp
);
294 static krb5_error_code
295 akf_add_entry(krb5_context context
,
297 krb5_keytab_entry
*entry
)
299 struct akf_data
*d
= id
->data
;
306 if (entry
->keyblock
.keyvalue
.length
!= 8)
308 switch(entry
->keyblock
.keytype
) {
309 case ETYPE_DES_CBC_CRC
:
310 case ETYPE_DES_CBC_MD4
:
311 case ETYPE_DES_CBC_MD5
:
317 fd
= open (d
->filename
, O_RDWR
| O_BINARY
| O_CLOEXEC
);
319 fd
= open (d
->filename
,
320 O_RDWR
| O_BINARY
| O_CREAT
| O_EXCL
| O_CLOEXEC
, 0600);
323 krb5_set_error_message(context
, ret
,
324 N_("open keyfile(%s): %s", ""),
332 sp
= krb5_storage_from_fd(fd
);
335 krb5_set_error_message(context
, ENOMEM
,
336 N_("malloc: out of memory", ""));
342 if(krb5_storage_seek(sp
, 0, SEEK_SET
) < 0) {
344 krb5_storage_free(sp
);
346 krb5_set_error_message(context
, ret
,
347 N_("seeking in keyfile: %s", ""),
352 ret
= krb5_ret_int32(sp
, &len
);
354 krb5_storage_free(sp
);
361 * Make sure we don't add the entry twice, assumes the DES
362 * encryption types are all the same key.
368 for (i
= 0; i
< len
; i
++) {
369 ret
= krb5_ret_int32(sp
, &kvno
);
371 krb5_set_error_message (context
, ret
,
372 N_("Failed getting kvno from keyfile", ""));
375 if(krb5_storage_seek(sp
, 8, SEEK_CUR
) < 0) {
377 krb5_set_error_message (context
, ret
,
378 N_("Failed seeing in keyfile: %s", ""),
382 if (kvno
== entry
->vno
) {
391 if(krb5_storage_seek(sp
, 0, SEEK_SET
) < 0) {
393 krb5_set_error_message (context
, ret
,
394 N_("Failed seeing in keyfile: %s", ""),
399 ret
= krb5_store_int32(sp
, len
);
402 krb5_set_error_message (context
, ret
,
403 N_("keytab keyfile failed new length", ""));
407 if(krb5_storage_seek(sp
, (len
- 1) * (8 + 4), SEEK_CUR
) < 0) {
409 krb5_set_error_message (context
, ret
,
410 N_("seek to end: %s", ""), strerror(ret
));
414 ret
= krb5_store_int32(sp
, entry
->vno
);
416 krb5_set_error_message(context
, ret
,
417 N_("keytab keyfile failed store kvno", ""));
420 ret
= krb5_storage_write(sp
, entry
->keyblock
.keyvalue
.data
,
421 entry
->keyblock
.keyvalue
.length
);
422 if(ret
!= entry
->keyblock
.keyvalue
.length
) {
427 krb5_set_error_message(context
, ret
,
428 N_("keytab keyfile failed to add key", ""));
433 krb5_storage_free(sp
);
438 const krb5_kt_ops krb5_akf_ops
= {
452 #endif /* HEIMDAL_SMALLER */